F5 fixes actively exploited zero-day flaw in BIG-IP APM
F5 patched actively exploited BIG-IP APM zero-day CVE-2026-94127, a 9.8 CVSS heap overflow RCE added to CISA's KEV catalog.
F5 fixed critical remote code execution flaw CVE-2026-94127 (CVSS 9.8), a heap-based buffer overflow affecting BIG-IP APM deployments configured as OAuth authorization servers, which was actively exploited before the patch released. CISA added the zero-day to its Known Exploited Vulnerabilities catalog, and Shadowserver tracks more than 15,000 internet-exposed BIG-IP APM deployments. Hotfixes cover the 21.x, 17.5.x, and 17.1.x branches, with an iRule available as interim mitigation. F5 advises reviewing logs for repeated OAuth authentication failures, suspicious commands, and TMM SIGABRT crashes as exploitation indicators.
- CVE-2026-94127: CVSS 9.8 heap overflow in BIG-IP APM OAuth authorization server configurations
- Actively exploited before patch; added to CISA KEV catalog Tuesday
- Over 15,000 BIG-IP APM deployments exposed online per Shadowserver
- Hotfixes for 21.x, 17.5.x, 17.1.x; interim iRule mitigation available
- IOC pattern: repeated OAuth failures, suspicious commands, then TMM SIGABRT crash
- Organizations
- F5CISAShadowserver Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-5352 | A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the… | 9.6 | <1% | PoC | |
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
2 min read at csoonline.com
Technology company F5 fixed a critical remote code execution vulnerability in its BIG-IP Access Policy Manager (APM) platform on Tuesday. The flaw impacts deployments configured as OAuth authorization servers and was already under active exploitation in the wild before the patch became available.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.